# Detection rules CLI

**URL:** <https://discuss.elastic.co/t/detection-rules-cli/268867>\
**Category:** SIEM\
**Created:** [March 31, 2021, 6:24am UTC](https://discuss.elastic.co/t/detection-rules-cli/268867 "2021-03-31T06:24:57Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![aditi\_salunke](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aditi_salunke/32/85600_2.png) [@aditi\_salunke](https://discuss.elastic.co/u/aditi_salunke)\
**Post date:** [March 31, 2021, 6:24am UTC](https://discuss.elastic.co/t/detection-rules-cli/268867/1 "2021-03-31T06:24:57Z")

</div>

```auto
Traceback (most recent call last):
  File "/usr/lib64/python3.8/runpy.py", line 194, in _run_module_as_main
    return _run_code(code, main_globals, None,
  File "/usr/lib64/python3.8/runpy.py", line 87, in _run_code
    exec(code, run_globals)
  File "/home/rootadmin/git/detection-rules/detection_rules/ __main__.py", line 34, in <module>
    main()
  File "/home/rootadmin/git/detection-rules/detection_rules/ __main__.py", line 31, in main
    root(prog_name="detection_rules")
  File "/home/rootadmin/.local/lib/python3.8/site-packages/click/core.py", line 764, in __call__
    return self.main(*args, **kwargs)
  File "/home/rootadmin/.local/lib/python3.8/site-packages/click/core.py", line 717, in main
    rv = self.invoke(ctx)
  File "/home/rootadmin/.local/lib/python3.8/site-packages/click/core.py", line 1137, in invoke
    return _process_result(sub_ctx.command.invoke(sub_ctx))
  File "/home/rootadmin/.local/lib/python3.8/site-packages/click/core.py", line 956, in invoke
    return ctx.invoke(self.callback, **ctx.params)
  File "/home/rootadmin/.local/lib/python3.8/site-packages/click/core.py", line 555, in invoke
    return callback(*args, **kwargs)
  File "/home/rootadmin/git/detection-rules/detection_rules/main.py", line 100, in import_rules
    rule_contents.extend(load_rule_contents(rule_file))
  File "/home/rootadmin/git/detection-rules/detection_rules/utils.py", line 254, in load_rule_contents
    rule = load_dump(rule_file)
  File "/home/rootadmin/.local/lib/python3.8/site-packages/eql/utils.py", line 140, in load_dump
    return toml.load(f)
  File "/home/rootadmin/.local/lib/python3.8/site-packages/toml/decoder.py", line 134, in load
    return loads(f.read(), _dict, decoder)
  File "/home/rootadmin/.local/lib/python3.8/site-packages/toml/decoder.py", line 455, in loads
    ret = decoder.load_line(line, currentlevel, multikey,
  File "/home/rootadmin/.local/lib/python3.8/site-packages/toml/decoder.py", line 725, in load_line
    value, vtype = self.load_value(pair[1], strictly_valid)
  File "/home/rootadmin/.local/lib/python3.8/site-packages/toml/decoder.py", line 802, in load_value
    return (self.load_array(v), "array")
  File "/home/rootadmin/.local/lib/python3.8/site-packages/toml/decoder.py", line 914, in load_array
    a[b] = a[b] + ',' + a[b + 1]
IndexError: list index out of range

```

-Following steps as per the link:[https://github.com/elastic/detection-rules](https://github.com/elastic/detection-rules)  
-After runnung command: python3.8 -m detection\_rules import-rules -d rules/windows recieving above error  
-i have installed dpendancies mentioned in requirements.txt which is on github link.

Please help me out to resolve this error.

---

<div class="post-metadata">

**Author:** ![justin\_ibarra](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/justin_ibarra/32/110828_2.png) [@justin\_ibarra](https://discuss.elastic.co/u/justin_ibarra)\
**Post date:** [April 1, 2021, 5:05pm UTC](https://discuss.elastic.co/t/detection-rules-cli/268867/3 "2021-04-01T17:05:00Z")

</div>

Hello,

Thanks for bringing this to our attention. The issue was with a dependency which loads the toml files. An [issue](https://github.com/elastic/detection-rules/issues/1072) was already opened in the repo for this and I have a draft PR in which will resolve this. I hope to have the PR merged soon.

If you are unable to wait or are feeling adventurous, the fix is [here](https://github.com/elastic/detection-rules/pull/1073/commits/ca1b1ab9190ebcb52d4e95b55b8e678176e5790e).

Let me know if there is anything else needed and feel free to continue this conversation within the issue itself

---

<div class="post-metadata">

**Author:** ![austinsonger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/austinsonger/32/78994_2.png) [@austinsonger](https://discuss.elastic.co/u/austinsonger)\
**Post date:** [April 1, 2021, 5:05pm UTC](https://discuss.elastic.co/t/detection-rules-cli/268867/4 "2021-04-01T17:05:20Z")

</div>

> [@aditi\_salunke](#):
>
> python3.8 -m detection\_rules import-rules

You can just use

```python
python -m detection_rules

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 29, 2021, 5:06pm UTC](https://discuss.elastic.co/t/detection-rules-cli/268867/5 "2021-04-29T17:06:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.